Secure Information and Resource Sharing in Cloud Infrastructure as a Service Cyber Incident Response Models for Information and Resource Sharing Amy(Yun) Zhang, Ram Krishnan, Ravi Sandhu Institute for Cyber Security University of Texas at San Antonio San Antonio, TX 78249 Nov 03, 2014 Presented by: Amy(Yun) Zhang UTSA
Information Sharing and Coordination Initiatives collaboration and • coordination to enhance situational awareness – Share malicious activities on federal systems – Technologies, tools, procedures, analytics UTSA 2 Ref: http://www.whitehouse.gov/issues/foreign-policy/cybersecurity/national-initiative
Electric Grid Scenario Cyber incidents in • electricity providers – Local utilities, regional, state, national operators • Need a standing platform that facilitates sharing – Controlled access UTSA 3
Scope • Focus on technical challenges • Sharing amongst a set of organizations – Information, infrastructure, tools, analytics, etc. – May want to share malicious or infected code/systems (e.g. virus, worms, etc.) – Sensitive – Often ad hoc • What are the effective ways to facilitate sharing in such circumstances? – Information sharing models – Infrastructure, technologies, platforms UTSA 4
Cyber Infrastructure for Sharing • Traditional platforms – Shared storage • SharePoint, Dropbox, Google Drive, etc. – Shared infrastructure • Grid computing • Modern platform – Cloud UTSA 6
Cloud IaaS Advantages for Cyber Incident Sharing • Virtualized resources – Theoretically, one can take a snapshot and mobilize • Operational efficiency – Light-weight and agile – Rapid deployment and configuration – Dynamic scaling – Self-service UTSA 7
Cloud IaaS Challenges for Cyber Incident Sharing • IaaS clouds lack secure sharing models – Storage – Compute – Networks Need ability to snapshot tenant • infrastructure, share, and control who can access – Share by copy UTSA 8
Sharing Model in Cloud IaaS Add/Remove Data Add/Remove Secure View #1: Org C Data View #1: Org A Participant Isolated View #2: SID Participant View #2: SID C Domain (SID) A Join/Leave Join/Leave Users Users Add/Remove Join/Leave Data Users Participant B Can create multiple secure View #1: Org B isolated projects (SIPs) View #2: SID within SID with different controls UTSA 9
OpenStack > 200 companies • OpenStack ~14000 developers >130 countries – Dominant open-source cloud IaaS software UTSA 10 Ref: http://www.openstack.org
OpenStack Access Control (OSAC) UTSA 11
OSAC-SID UTSA 12
Conceptual Model Administrative Model Collaboration Group Operational Model Establish/Disband Join User Join User Create RO/RW Subject Create RO/RW Subject Leave User Leave User Kill Subject Kill Subject Add Version ORG A Add Version ORG B Create Object Create Object Read/Update Version Remove Version Read/Update Version Remove Version Suspend/Resume Suspend/Resume Version Merge Version Merge Version Version Substitute User Substitute User Import Version UTSA 13
OSAC-SID Administrative Model UTSA 14
OSAC-SID Operational Model UTSA 15
SID and SIP in OpenStack SID-Critical-Infrastructure CPS SAWS Admin : CPSadmin Admins : Admin : SAWSadmin CPSadmin, SAWSadmin Users: Alice@CPS, Bob@CPS Create Users: Harry@SAWS Join Users: Alice@CPS, Harry@SAWS member member SIP- PortScanning IT-CPS IT-SAWS member member SIP-DOS Share objects, VMs, etc. Admin : SAPDadmin Users: Martin@SAPD member IT-SAPD SAPD UTSA 16
Conclusion and future work Developed sharing models • – Formal specification • Enhanced OpenStack with SID/SIP capabilities – Cyber incident response capabilities • Self-service • SID/SIP specific security • Share data, tools, etc. in an isolated environment • Ability to execute and analyze malicious code in an isolated environment – Practitioners can deploy a “cyber incident response” cloud – Potential blueprint for official OpenStack adoption • Future work – more fine grained access control within a SIP – harden the implementation to prevent overt information flow UTSA 17
Thanks • Q&A UTSA 18
Recommend
More recommend
